6f8c35ba78a7231e71e69a5ff2578a1f78c6c74cbc26a8e5a3807b222e5cf384

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21/08/2023, 19:06

Target

6f8c35ba78a7231e71e69a5ff2578a1f78c6c74cbc26a8e5a3807b222e5cf384.dll
Size

1.6MB
MD5

b892f4ec2762881186f7fab984bb991a
SHA1

90ac8cfcbdced9644146269b96fccb74719b4a43
SHA256

6f8c35ba78a7231e71e69a5ff2578a1f78c6c74cbc26a8e5a3807b222e5cf384
SHA512

27e394e887177902a65d4570072eaceb27901176d09a757dd0cf5a13b5a737659ee32512dd788e6c6153664a31501c2e1e10c7cabcfa8b4b1313941022882097
SSDEEP

24576:fpMB0haU20ucA6g+OHXllFtDs8wKgLhARLD1VM:a0d20M+OHXllF71D1VM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2520	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2520	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2520	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2520	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2520	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2520	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2520	2076	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6f8c35ba78a7231e71e69a5ff2578a1f78c6c74cbc26a8e5a3807b222e5cf384.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6f8c35ba78a7231e71e69a5ff2578a1f78c6c74cbc26a8e5a3807b222e5cf384.dll
  2⤵
  PID:2520

memory/2520-54-0x0000000001E90000-0x0000000002028000-memory.dmp

Filesize
1.6MB

Download